From 485a99feffda97606584d2b1ab54f5812a6f9f69 Mon Sep 17 00:00:00 2001
From: Ben Orchard <thefirstmuffinman@gmail.com>
Date: Fri, 10 Oct 2025 12:27:58 +0100
Subject: [PATCH 1/2] haskellPackages.HsOpenSSL-x509-system: fix Mac runtime

It's the same sort of platform-specific code as the
{crypton-,}x509-system packages. Applying the same bandaid fixes.
---
 .../development/haskell-modules/configuration-darwin.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/haskell-modules/configuration-darwin.nix b/pkgs/development/haskell-modules/configuration-darwin.nix
index f3387cd2ce7f..494a7c03da41 100644
--- a/pkgs/development/haskell-modules/configuration-darwin.nix
+++ b/pkgs/development/haskell-modules/configuration-darwin.nix
@@ -108,6 +108,15 @@ self: super:
         + (drv.postPatch or "");
       }
     ) super.crypton-x509-system;
+    HsOpenSSL-x509-system = overrideCabal (
+      drv:
+      lib.optionalAttrs (!pkgs.stdenv.cc.nativeLibc) {
+        postPatch = ''
+          substituteInPlace OpenSSL/X509/SystemStore/MacOSX.hs --replace-fail security /usr/bin/security
+        ''
+        + (drv.postPatch or "");
+      }
+    ) super.HsOpenSSL-x509-system;
 
     # https://github.com/haskell-foundation/foundation/pull/412
     foundation = dontCheck super.foundation;

From 4debea0de966f33505b745cfc681088c53e29921 Mon Sep 17 00:00:00 2001
From: Ben Orchard <thefirstmuffinman@gmail.com>
Date: Fri, 10 Oct 2025 12:33:43 +0100
Subject: [PATCH 2/2] haskellPackages: change darwin postPatch substitutes to
 use --replace-fail

---
 .../haskell-modules/configuration-darwin.nix     | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/haskell-modules/configuration-darwin.nix b/pkgs/development/haskell-modules/configuration-darwin.nix
index 494a7c03da41..1eee042e93e0 100644
--- a/pkgs/development/haskell-modules/configuration-darwin.nix
+++ b/pkgs/development/haskell-modules/configuration-darwin.nix
@@ -94,7 +94,7 @@ self: super:
       drv:
       lib.optionalAttrs (!pkgs.stdenv.cc.nativeLibc) {
         postPatch = ''
-          substituteInPlace System/X509/MacOS.hs --replace security /usr/bin/security
+          substituteInPlace System/X509/MacOS.hs --replace-fail security /usr/bin/security
         ''
         + (drv.postPatch or "");
       }
@@ -103,7 +103,7 @@ self: super:
       drv:
       lib.optionalAttrs (!pkgs.stdenv.cc.nativeLibc) {
         postPatch = ''
-          substituteInPlace System/X509/MacOS.hs --replace security /usr/bin/security
+          substituteInPlace System/X509/MacOS.hs --replace-fail security /usr/bin/security
         ''
         + (drv.postPatch or "");
       }
@@ -133,7 +133,7 @@ self: super:
       # when called from GHC, probably because clang is version 7, but we are
       # using LLVM8.
       preCompileBuildDriver = ''
-        substituteInPlace Setup.hs --replace "addToLdLibraryPath libDir" "pure ()"
+        substituteInPlace Setup.hs --replace-fail "addToLdLibraryPath libDir" "pure ()"
       ''
       + (oldAttrs.preCompileBuildDriver or "");
     }) super.llvm-hs;
@@ -174,7 +174,7 @@ self: super:
     HTF = overrideCabal (drv: {
       # GNU find is not prefixed in stdenv
       postPatch = ''
-        substituteInPlace scripts/local-htfpp --replace "find=gfind" "find=find"
+        substituteInPlace scripts/local-htfpp --replace-fail "find=gfind" "find=find"
       ''
       + (drv.postPatch or "");
     }) super.HTF;
@@ -194,7 +194,7 @@ self: super:
     # however linking against it is also not necessary there
     GLHUI = overrideCabal (drv: {
       postPatch = ''
-        substituteInPlace GLHUI.cabal --replace " rt" ""
+        substituteInPlace GLHUI.cabal --replace-fail " rt" ""
       ''
       + (drv.postPatch or "");
     }) super.GLHUI;
@@ -203,7 +203,7 @@ self: super:
       # Prevent darwin-specific configuration code path being taken
       # which doesn't work with nixpkgs' SDL libraries
       postPatch = ''
-        substituteInPlace configure --replace xDarwin noDarwinSpecialCasing
+        substituteInPlace configure --replace-fail xDarwin noDarwinSpecialCasing
       ''
       + (drv.postPatch or "");
       patches = [
@@ -216,7 +216,7 @@ self: super:
     # doesn't work with nixpkgs' SDL libraries
     SDL-mixer = overrideCabal (drv: {
       postPatch = ''
-        substituteInPlace configure --replace xDarwin noDarwinSpecialCasing
+        substituteInPlace configure --replace-fail xDarwin noDarwinSpecialCasing
       ''
       + (drv.postPatch or "");
     }) super.SDL-mixer;
@@ -322,7 +322,7 @@ self: super:
     # Remove a problematic assert, the length is sometimes 1 instead of 2 on darwin
     di-core = overrideCabal (drv: {
       preConfigure = ''
-        substituteInPlace test/Main.hs --replace \
+        substituteInPlace test/Main.hs --replace-fail \
           "2 @=? List.length (List.nub (List.sort (map Di.log_time logs)))" ""
       '';
     }) super.di-core;